Not sure if $taboo was getting sanitized or not. Possibly an SQL injection vulnerability that allows maliciously crafted group names to inject SQL at a later date when the group CP is loaded. Unconfirmed, theoretical fix.
function init() {
tinyMCEPopup.resizeToInnerSize();
var formObj = document.forms[0];
formObj.numcols.value = tinyMCE.getWindowArg('numcols', 1);
formObj.numrows.value = tinyMCE.getWindowArg('numrows', 1);
}
function mergeCells() {
var args = new Array();
var formObj = document.forms[0];
if (!AutoValidator.validate(formObj)) {
alert(tinyMCE.getLang('lang_invalid_data'));
return false;
}
args["numcols"] = formObj.numcols.value;
args["numrows"] = formObj.numrows.value;
tinyMCEPopup.execCommand("mceTableMergeCells", false, args);
tinyMCEPopup.close();
}